QWED-MCP, a Verification Gateway, Passed Attacker Math Straight to SymPy parse_expr (CVE-2026-55546, 9.8)

GitHub Security Advisories·high signalXBlueskyLinkedInCopy link

Published 2026-08-25, this critical bug sits in `verify_math_expression()` in QWED-MCP, described as "a deterministic verification gateway for MCP." It passes the attacker-controlled expression and claimed_result strings to SymPy's `parse_expr()` after only normalizing caret syntax to Python exponents, with no `global_dict` restriction, no removal of Python builtins, and no AST validation, which is remote code execution. Fixed in 0.2.1. The lesson for builders wiring in verification MCP servers: a tool whose job is to check the model's work is an unusually trusted call site, and this one evaluates its input.